Convert SSL certificate formats with OpenSSL - Rocketeers app

  [ Rocketeers ](/)   

[Login](https://rocketeersapp.com/login) 

 On this page

 Knowledge
---------

Convert SSL certificate formats with OpenSSL
============================================

### [\#Security](https://rocketeersapp.com/knowledge/security)

Certificates come in PEM, CRT, CER, DER, and PFX formats, and software is picky about which one it wants. Here are the openssl commands to convert between all of them.

 Published by [Mark van Eijk](https://rocketeersapp.com/author/mark-van-eijk) on June 23, 2026 · 1 minute read

1. [The formats, quickly](#content-the-formats-quickly)
2. [PEM and CRT](#content-pem-and-crt)
3. [PEM to DER](#content-pem-to-der)
4. [DER to PEM](#content-der-to-pem)
5. [PFX to PEM (certificate and key)](#content-pfx-to-pem-certificate-and-key)
6. [PEM/CRT and key to PFX](#content-pemcrt-and-key-to-pfx)
7. [Verify the result](#content-verify-the-result)

[\#](#content-the-formats-quickly "Permalink")The formats, quickly
------------------------------------------------------------------

Before converting, it helps to know what you actually have:

- **PEM** — Base64 text, starts with `-----BEGIN CERTIFICATE-----`. The most common format on Linux. Can hold a certificate, a key, or a whole chain.
- **CRT / CER** — usually just a PEM (or DER) certificate with a different file extension.
- **DER** — the binary version of a PEM certificate. Common in the Windows and Java world.
- **PFX / P12** — a binary, password-protected bundle holding the certificate **and** its private key together. Standard on Windows / IIS.

Everything below uses the `openssl` command line tool.

[\#](#content-pem-and-crt "Permalink")PEM and CRT
-------------------------------------------------

These are typically the same format, so converting is often just a rename. To be safe, normalise to PEM:

 ```
openssl x509 -in certificate.crt -out certificate.pem -outform PEM

```

[\#](#content-pem-to-der "Permalink")PEM to DER
-----------------------------------------------

 ```
openssl x509 -in certificate.pem -outform DER -out certificate.der

```

[\#](#content-der-to-pem "Permalink")DER to PEM
-----------------------------------------------

 ```
openssl x509 -in certificate.der -inform DER -out certificate.pem -outform PEM

```

[\#](#content-pfx-to-pem-certificate-and-key "Permalink")PFX to PEM (certificate and key)
-----------------------------------------------------------------------------------------

A PFX bundles both parts. To pull them out into a single PEM file:

 ```
openssl pkcs12 -in certificate.pfx -out certificate.pem -nodes

```

If you only want one part, see the dedicated guides for [extracting the certificate from a PFX file](/extract-certificate-from-pfx-file) and [extracting the private key from a PFX file](/extract-private-key-from-pfx-file).

[\#](#content-pemcrt-and-key-to-pfx "Permalink")PEM/CRT and key to PFX
----------------------------------------------------------------------

Going the other way — bundling a certificate and its private key into a PFX for Windows or IIS:

 ```
openssl pkcs12 -export -out certificate.pfx \
  -inkey private.key -in certificate.crt

```

Add the intermediate certificate so the bundle carries the full chain:

 ```
openssl pkcs12 -export -out certificate.pfx \
  -inkey private.key -in certificate.crt -certfile intermediate.crt

```

You'll be prompted for an export password, which whoever imports the PFX will need.

[\#](#content-verify-the-result "Permalink")Verify the result
-------------------------------------------------------------

After any conversion, confirm the certificate is readable and contains what you expect:

 ```
openssl x509 -in certificate.pem -noout -text

```

If your goal is a working HTTPS setup, make sure the certificate you serve includes the intermediates — see [what is an SSL certificate chain](/what-is-an-ssl-certificate-chain).

### Subscribe to our newsletter

Do you want to receive regular updates with fresh and exclusive content to learn more about web development, hosting, security and performance? Subscribe now!

  Fill in your email address to receive updates  Subscribe 

#### More in [\#Security](https://rocketeersapp.com/knowledge/security)

- [How to extract the certificate from a PFX file](https://rocketeersapp.com/knowledge/extract-certificate-from-pfx-file)
- [How to extract private key from PFX file](https://rocketeersapp.com/knowledge/extract-private-key-from-pfx-file)
- [How to optimize web application security](https://rocketeersapp.com/knowledge/optimize-web-application-security)
- [How to get A+ grade SSL using Cloudflare](https://rocketeersapp.com/knowledge/a-plus-grade-ssl-using-cloudflare)
- [How to setup OpenClaw securely on your own VPS](https://rocketeersapp.com/knowledge/setup-openclaw-vps-securely)
- [How to generate a CSR with OpenSSL](https://rocketeersapp.com/knowledge/generate-csr-with-openssl)

 [View all 15 articles →](https://rocketeersapp.com/knowledge/security)